hunt-cloud-misconfig

hunt-cloud-misconfig is a Penetration testing & red team skill for AI agents, published by elementalsouls in the Claude-BugHunter repository on GitHub. Skillspace rates hunt-cloud-misconfig F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.

Risky. This skill has patterns associated with unsafe behaviour. Read the source carefully before running it.

Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).

Grade

F

Quality

45 / 100

Safety

Risky

GitHub stars

4,464

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.